Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Let's build a Chrome extension that steals as much data as possible

mattfrisbie.substack.com

Post reply on HN
Print view View original

61–70 of 320 posts

Re: Let's build a Chrome extension that steals as much data as possible

#61

Post by mard »

wolpoli wrote: post #29

One of the issues here is that the browser is prompting the user for all the Permissions at install time. Both Android and IOS have moved away from that. Perhaps it is time browsers to move away from that as well.

Extensions are one thing, but I'd also welcome granular permissions to various JavaScript capabilities for every website. I don't like when some websites capture native browser hotkeys (CTRL+F), disable my right mouse button, change scrolling behavior or perform asynchronous HTTP requests. The only solution I found to protect against these practices is disabling JavaScript completely for given site, but more often than not it prevents the page from rendering altogether.

Re: Let's build a Chrome extension that steals as much data as possible

#62

Post by jefftk »

eyelidlessness wrote: post #15
metadat wrote: post #9

> Chrome scrolls the permission warning message container, so more than half of the warning messages don’t even show up. I’d bet most users wouldn’t think twice about installing an extension that appears to ask for just 5 permissions. An egregious and nearly unbelievable oversight on Google's part. :-\ As a developer, it's unimaginable to me to not test the extreme high and low numbers of inputs cases to ensure thing…

This introduces an especially silly attack vector: if you expect that asking for a specific permission might alarm users, and if you can push it below the fold, just ask for more innocuous or plausible permissions than you need! Besides the oversight of hiding some permission requests, this highlights that the order they’re presented matters too. Even if it weren’t scrollable with ~invisible indication of that, peopl…

> just ask for more innocuous or plausible permissions than you need!

Looking at the list I think they're sorting by ~alarmingness, so it seems hard to push an alarming one below the fold with innocuous ones?

Re: Let's build a Chrome extension that steals as much data as possible

#63

Post by jefftk »

ClumsyPilot wrote: post #30
nostromo wrote: post #11

Wait until you see what’s possible with executables! I like this project, but I also worry that eventually we’re going to lose access to extensions entirely because people will take away the wrong message. Safeguards are good, but at a certain point I want my devices to trust that I know what I’m doing.

> Wait until you see what’s possible with executables! The most important thing is whay you tell the user - Windows says "We don't know where Trojan.exe came from, it could be a virus, are you sure you want to run it?" Chrome says: "You downloaded Trojan.exe from our store, we manage it and check it for viruses. It only asks for harmless permission, install it!" One is warning you, the other is entrapment.

> It only asks for harmless permission, install it!

I see it asking for two very scary permissions, two somewhat scary permissions, and one annoying one?

Re: Let's build a Chrome extension that steals as much data as possible

#64

Post by jefftk »

whalesalad wrote: post #33
drpixie wrote: post #20

I'd like a fork of chrome which removes all (or at least most) the "features" mentioned - a browser that renders well but just doesn't support these masses of unsecure features. If you want to give 3rd parties access to all that stuff, you can run chrome. But I don't - I want the bare minimum that will run normal websites. I know that will break some pages, I'll accept that. (And that would give me a smaller & faster…

https://github.com/ungoogled-software/ungoogled-chromium

The features mentioned in the article are available to extensions, and ungoogled-chromium supports these just as well.

Re: Let's build a Chrome extension that steals as much data as possible

#65

Post by dcow »

mfrisbie wrote: post #18

Author here! I'm tickled to see that this whimsical cautionary tale is so resonant.

Do you have any concrete recommendations beyond the obvious "fix the glaring permissions UI scroll box issue"? Are you advocating for browsers to remove these permissions altogether because you feel they're too dangerous? Are you lobbying for a shift towards use-site triggered permission requests like Safari does? It seems you understand the tale is whimsical but I fear some people view it much more seriously and want to start an extension witch hunt. It would be nice to see a concrete call to action so it would be more clear what your proposed solution is instead of just inciting a bunch of pitchforks with no clear goal.

Re: Let's build a Chrome extension that steals as much data as possible

#66

Post by metadat »

jszymborski wrote: post #44
2OEH8eoCRo0 wrote: post #40

Earlier quoted context omitted.

> if this kind of issue can fly undetected for so long, what can organizations with drastically less resources than $GOOG do to ensure adequate velocity while not leaving the proverbial barn doors open? If $GOOG can't do it with practically infinite resources then I'm of the opinion that nobody can. Computing is broken.

Are we certain that they are motivated to do so? Google doesn't strike me as a company committed to user privacy.

There is no company on earth with a larger privacy organization than Google.

Edit: @dogecoinbase: What you propose is a shallow and dismissive analysis of the oversimplicative variety. Please put in a little more effort before derailing an otherwise thoughtful conversation.

Re: Let's build a Chrome extension that steals as much data as possible

#68

Post by Dalewyn »

crazygringo wrote: post #50
metadat wrote: post #9

> Chrome scrolls the permission warning message container, so more than half of the warning messages don’t even show up. I’d bet most users wouldn’t think twice about installing an extension that appears to ask for just 5 permissions. An egregious and nearly unbelievable oversight on Google's part. :-\ As a developer, it's unimaginable to me to not test the extreme high and low numbers of inputs cases to ensure thing…

> An egregious and nearly unbelievable oversight on Google's part. :-\ I agree it's egregious, but it's quite easy to believe. It's surely just using a standard modal and passing a string. The thing is, this is on a Mac that has scroll bars that are invisible until you scroll. It's easy to imagine testing was done other OS's where the scroll bars are obvious and the bottom line might be only partially hidden which ma…

>this is on a Mac that has scroll bars that are invisible until you scroll.

What modern UI even has visible scroll bars by default?

And assuming it's even visible (either by default or user-configured after the fact if that's even possible), what modern UI even has scroll bars wider than 1px?

Re: Let's build a Chrome extension that steals as much data as possible

#69

Post by modeless »

dcow wrote: post #45

This is a spicy essay for sure but what is the author's actual point? If the user grants you permission to do all these things, then you have permission to do all these things. If you can't be trusted and abuse that permission then you are not ethical. If you aren't ethical someone will find out and your extension will be removed in the worst case and simply not approved in the common case. The author even admits as…

Is that solving any real problem? Will any single person actually be protected by that annoyance? The permissions already appear roughly sorted by invasiveness. Is the sixth one really going to be the one that your install decision hinges on? I mean, once you have "Read and change all your data on websites" it's game over anyway if the extension is truly malicious.

Re: Let's build a Chrome extension that steals as much data as possible

#70

Post by dcow »

nine_k wrote: post #58
dcow wrote: post #48

Earlier quoted context omitted.

What? The same can happen with any piece of software in the world. Why single out extensions?

Not really any: popular open-source software, which gets reviewed and rebuilt by many independent people (distro maintainers) has a much lower chance to be hijacked this way.

Oh yes it can. Project owners have sold out before--sometimes without telling anybody. The threat vector is the same. Something you trust gets sold to someone else and it abuses previously acquired trust. Open source doesn't actually fix this specific trust issue. And BTW your browser extension's source is available to peruse locally on your machine after you install it. Surely you did that, right?
Post reply on HN